How are you dealing with the continued prevalence of ransomware attacks?

We have a Strategy in place to implement Zero Trust and are partnering with multiple 3rd party partners to support our Strategic Security Program. 

We started implementing Zero Trust approach.

You have to build resiliency. That's the conversation: you have to make sure there's a resiliency plan in place as you're designing new architectures, or deploying new technologies. Oftentimes the ransom has to be paid just to ensure the attackers do not disclose data. If they’re recoverable, the company can recover from their backups and be fully operational. But even if there is no major impact in terms of operations, the business still has to pay the ransom because of the potential consequences of a data leak.

The risk assumption that I operate on is that things are broken, you just don't know how. So how do you plan defense responses, and even detection and mitigation that is reflective of that fact. You won’t be able to solve everything, but how do you make sure your fence is built tall enough from a discovery and prevention standpoint? And how do you operate on the assumption that you're going to get breached? That stuff will happen, so you have to plan ahead. It’s dark, but it feels more resilient.

I saw this incredible write up from one of the Log4j maintainers on what it's like to be someone who's been volunteering their time to support code that powers half the internet, and then get yelled at all at once by everyone on the internet. It sucks when you think it through, of course. That's terrible. But for some reason, we're not planning ahead for that type of thing. And assuming that there will be swings and roundabouts that are uncomfortable for us to deal with, we need to try to ring-fence however we can.